Later archive addition

Exposing Private Information by Timing Web Applications

Andrew Bortz, Dan Boneh and Palash Nandy

Web response times leak private state. Direct timing distinguishes valid from invalid usernames at login pages and counts hidden photo albums behind access control, accurate above 95% from ten samples.

Record

Researcher

Andrew Bortz, Dan Boneh and Palash Nandy

In the archive

• Added to the 2007 archive after the original list was published

Related sources

• Paper

Tags

• timing-attack
• side-channel
• xsleak
• info-leak
• csrf
• same-origin-policy
• measurement-study
• mitigation
• owasp-a01-2021

This page is the archive's own catalogue record. The research is the work of Andrew Bortz, Dan Boneh and Palash Nandy, first published at the original source. Preserved copies are kept so the citation survives its host.